Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Add authentication to .NET MAUI apps. Covers WebAuthenticator for generic OAuth 2.0 / social login, and MSAL.NET for Microsoft Entra ID (Azure AD) with broker support (Microsoft Authenticator), token caching, Conditional Access, platform-specific setup (Android, iOS, Windows), DelegatingHandler for bearer token API calls, and Blazor Hybrid integration. USE FOR: "add authentication", "OAuth login", "MSAL.NET", "social login", "WebAuthenticator", "Entra ID MAUI", "Azure AD login", "Google login MAUI", "Apple login MAUI", "token caching", "bearer token", "sign in". DO NOT USE FOR: secure local storage of tokens (use maui-secure-storage), Aspire-specific auth setup (use maui-aspire), or server-side Entra ID provisioning (use entra-id-aspire-provisioning).
(NS) Security/compat/a11y hygiene + Vercel Web Interface Guidelines review (headers, CSP, deps, accessibility). Use when hardening security, fixing CSP/CORS/headers, reviewing UI / checking a11y / auditing UX, or applying Web Interface Guidelines — even without saying "best practices"; also at ns-proto-creator close-out. Do NOT use for MR/SOLID review (ns-code-reviewer), visual redesign (ns-code-frontend-design), or feature implementation (ns-code-coder / ns-spec-driven).
Load PROACTIVELY when task involves payments, billing, or subscriptions. Use when user says "add payments", "integrate Stripe", "set up subscriptions", "add a checkout flow", or "handle billing webhooks". Covers Stripe, LemonSqueezy, and Paddle integration, checkout sessions, subscription lifecycle management, webhook verification and handling, customer portal, metered billing, refunds, and PCI compliance considerations.
Standalone skill for multi-perspective PLC code security and quality analysis. Triggers on: "review", "audit", "analyze", "security check", "vulnerability scan", "code review", "check this code", "is this safe", "find issues" when combined with PLC, SCL, ST, LAD, FBD, Structured Text, or block context. Also triggers when the user pastes PLC code and asks for feedback, or uploads exported SimaticML XML files. This skill is independent of tia-openness-roadmap — it does not perform engineering automation. It analyzes code that has already been exported or pasted.
Unified handling of address space conversion: determining PIE/ASLR base addresses, RVA/VA conversion, loader offset (firmware load address vs link address), cross-tool address alignment (Ghidra/angr/frida/gdb). Triggers: PIE, ASLR, base address, RVA, VA, loader offset, address conversion, relocated address, computing addresses in gdb, angr addresses.
Recognize defensive deception during an engagement — honeypots, honeytokens and canary tokens, decoy AD accounts and shares, canary files, and deceptive cloud credentials — before interacting with them, and handle a suspected decoy without burning the engagement. Use when a target is unexpectedly easy, when credentials or a service appear in an implausible place, when a privileged account has no logon history, when a file or bucket looks like bait, or when deciding whether to use credentials of unknown provenance.
Full red team assessment methodology. Use when starting a complete penetration testing project/red team assessment and you need end-to-end orchestration from reconnaissance to reporting. Applies to external-facing footholds, security assessment projects, and periodic penetration tests. This skill handles task scheduling - call specialized skills for specific exploits; do not perform deep vulnerability testing within this skill.
Reverse engineer React Native mobile apps, including Hermes bytecode bundles, using hbctool, hermes-dec, and Frida. Use when an APK contains index.android.bundle or libhermes.so, when an IPA contains main.jsbundle, when jadx shows only ReactActivity classes, or when a bundle file starts with the Hermes magic bytes instead of readable JavaScript.
This skill should be used when the user asks to “search for exposed devices on the internet,” “perform Shodan reconnaissance,” “find vulnerable services using Shodan,” “scan IP ranges with Shodan,” or “discover IoT devices and open ports.” It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
SQL injection screening for host code (MoonBit / TS / Rust) plus secretlint setup notes. Flags single-line template-literal or string-concat SQL builders, regardless of value source — the scanner is line-based and does NOT trace data flow, so a clean scan is not proof of safety (multi-line template literals are missed) and every hit needs a manual review or an explicit `// sql-security: ok` opt-out.
Volcengine compliance best-practices assistant: (1) based on the user's needs (compliance standards to meet, keywords, risk levels of concern), recommend which built-in Volcengine conformance pack templates to enable and flag which are already enabled; (2) summarize the account's current compliance posture, aggregating the evaluation results of active rules/conformance packs (built-in + user-defined) by category (regulatory / best practice / custom) and severity into a compliance overview report; (3) when the official baseline does not cover a case, guide the user in writing a Rego policy as a custom compliance rule and registering the evaluation. Can deploy recommended templates as conformance packs after user confirmation. Use when the user wants to do "compliance check / compliance inspection / security compliance / compliance best practices / which compliance rules to enable / MLPS compliance / is my Volcengine account compliant / what is non-compliant / help me write a custom compliance rule", or mentions Volcengine "Config / conformance pack / Rego policy". Trigger on the keywords 火山 / 火山引擎 / volcengine combined with compliance scenarios. Deploying conformance packs / registering custom rules are write operations and require user confirmation; compliance reports and resource remediation are strictly separated.
Workflow for pure-algorithm reverse engineering in Web/JS: pure-algorithm captchas, complex header/cookie signatures, hybrid encryption, JSVMP/VMP, Wasm, PoW, response decryption, fingerprint and challenge parameter recovery. For scenarios that need to trace back from the final request, final cookie, final verify or final WebSocket frame to the writer, builder, entry and source; design alignment checkpoints between the browser and the local environment; decide when to do AST de-obfuscation, when to instrument, when to do minimal environment shimming, when to split the image track from the parameter track; and turn research results into a solver, SDK, script or service. Use when the user explicitly mentions pure-algorithm, pure-algorithm captcha, slider, click-select, rotate, PoW, collect, w, x-s, a_bogus, encSecKey, captchaBody, X-Bogus, Wasm, Chinese national cryptography, environment shimming, fingerprint, challenge, verify, header signature or cookie signature.
Review abuse, fraud, spam, promotion abuse, payment fraud, refund abuse, account takeover risk, marketplace trust, game economy exploits, referral abuse, automation abuse, and moderation risk for software products. Use when designing controls, risk ladders, rate limits, manual review, user messaging, support escalation, or fraud-safe product systems.
Gives the agent a cryptographic Alien Agent ID linked to a verified human owner, signed authentication to Alien-aware services over RFC 9449 DPoP, an encrypted vault for service credentials (GitHub, Slack, AWS, etc.), and SSH-signed git commits with provenance trailers. Use when the user asks to bootstrap an Alien identity, sign in to an Alien Network service (anything under alien-api.com / alien.org / agent-sso.*), post to or call such a service, store or retrieve service credentials securely, or make commits attributable to a specific agent + human owner. Also triggers on the terms "Alien ID", "Agent ID", "DPoP", "cnf.jkt", or "owner binding".
Android app penetration testing methodology. Covers APK static analysis (decompilation/code audit/Manifest analysis), dynamic analysis (Frida Hook/SSL Pinning bypass/traffic capture), data storage security, component security (Activity/Service/Provider/Receiver), WebView security, and Root detection bypass. Triggered when an Agent needs to test Android app security, analyze APK files, or bypass app protection mechanisms.
Attack OAuth 2.0 and OpenID Connect flows — enumerate endpoints from the OIDC discovery document, break redirect_uri validation with path traversal, open-redirect chaining, subdomain and regex weakness, and %2F/@ parser tricks, exploit missing state (callback CSRF) and absent or downgraded PKCE, steal codes and tokens via open redirectors and referer leakage, replay and inject authorization codes across clients, escalate scope and bypass consent, confuse access_token with id_token, and take over accounts through "Sign in with X" email trust and device-code consent phishing. Use when you see /authorize, /oauth/token, response_type, redirect_uri, client_id, code= or state= parameters, a "Sign in with Google/Microsoft/GitHub" button, or an OIDC discovery document at /.well-known/openid-configuration.
Use when authenticating or authorizing requests to any Mailtrap API (Email Send, Email Testing/Sandbox, Templates, Contacts, Sending Domains, Suppressions). Use when picking the auth header, choosing token scope, storing tokens safely, or resolving the Mailtrap account_id. Use before writing or generating any Mailtrap API call.
Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive tooling, CTF). Filters by topic, difficulty, language, and resource type. Returns top references with archive fallbacks. Defensive and educational use only.
Use when checking code quality, running security audits, testing coverage, finding SOLID/DRY violations, or setting up quality tools. Use when user says "audit this code", "check security", "run PHPStan", "code quality", "find violations", "SOLID check", "DRY check", "test coverage", "lint this", "security review", "is this production ready", "check for vulnerabilities", "code review", "grade this code", "watch mode lint", "deep review", "ultrareview", "schedule quality sweep". Supports Drupal (PHPStan, PHPMD, Psalm, Semgrep, Trivy, Gitleaks via DDEV) and Next.js (ESLint, Jest, Semgrep, Trivy, Gitleaks). Use proactively before deployment or after significant code changes.
Frontend-focused code review skill for React/TypeScript/Tailwind projects. Analyzes code quality, security vulnerabilities (XSS, CSRF), performance issues, accessibility (WCAG), React best practices, hooks usage, component architecture, responsive design, and SEO. Use when users request code review, want feedback on components, ask about frontend security, performance optimization, or accessibility compliance. Provides actionable feedback with severity levels and fix suggestions.
Design and audit data deletion and erasure workflows covering user/account deletion, DSAR/RTBF, retention schedules, backups, logs, analytics, billing records, legal holds, fraud/security exceptions, subprocessors, exports, audit proof, customer communication, and recovery limits. Use when personal or customer data must be removed safely and provably.
Automatically synthesize, apply, and verify security remediations for vulnerabilities identified by fable-redteam. Generates surgical AST and code patches, creates continuous TDD regression test guards, performs atomic workspace mutations with automated rollback circuit breakers, and seals cryptographic healing attestations.
Execute native agentic ethical penetration testing and automated security audits against staging or authorized application targets. Discovers API logic flaws, BOLA/IDOR vulnerabilities, missing authentication, sensitive file exposures, and security misconfigurations within bounded scope. Produces verified security findings with reproduction PoCs and automatic Fable remediation work cards.
Conduct threat modeling, vulnerability assessments, secret sanitization, and security reviews across trust boundaries, auth flows, and untrusted inputs. Use when auditing authentication/authorization logic, inspecting APIs for injection/CORS/CSRF risks, checking for hardcoded credentials, or reviewing security-sensitive diffs — even if the user does not explicitly say "fable-security" (e.g. "security audit this code", "check for vulnerabilities", "verify auth logic", "scan for leaked secrets"). Do NOT use for general style reviews (use fable-review) or non-security bug fixes (use fable-tdd).
Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secret lifecycle management, KMS (Key Management Service) for encryption key management, rotation diagnosis, and KMS key usage auditing via CTS (Cloud Trace Service). Service keywords: dew, kms, csms, cts, secretsmanager, secrets manager, cloud secret management service, key management service, data encryption workshop, data encryption service, DEW service, KooCLI, 数据加密服务, 密钥管理服务, 凭据管理服务, DEW, KMS, CSMS, CTS, 密钥, 凭据, 加密, 轮转. Provides 10 huawei_* actions: huawei_list_csms_secrets, huawei_describe_csms_secret, huawei_list_csms_secret_versions, huawei_list_kms_keys, huawei_analyze_dew_rotation, huawei_analyze_dew_key_usage, huawei_create_kms_key, huawei_enable_csms_secret_rotation, huawei_update_csms_secret_version, huawei_delete_kms_key. Triggers include: "secret","credential","API key","token","password","encrypt","decrypt","KMS","CSMS","DEW","secretsmanager","certificate","CSR","rotation","密钥","凭据","加密","轮转","数据加密","访问密钥","加密密钥". Activates for ANY task involving secrets or credentials — load this skill before touching secrets.
Internal network information gathering and topology mapping. Use after breaching the boundary and obtaining an internal foothold. Covers live host discovery, port scanning, service identification, and locating key infrastructure (domain controllers/databases/mail/file servers). The first step of internal penetration testing — read the map before acting
Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.
Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.
Keep the durable record that outlives a session — credential provenance, access inventory, artifacts left on target for cleanup, findings with evidence, and a dead-end log — so work spanning days or analysts does not restart or contradict itself. Use when an engagement or investigation runs longer than one sitting, when resuming work after a gap, when handing off to another analyst, before a context window rolls over, or when you cannot say where a credential or access came from.
Add secure storage to .NET MAUI apps using SecureStorage.Default. Covers SetAsync, GetAsync, Remove, RemoveAll, platform setup (Android backup rules, iOS Keychain entitlements, Windows limits), common pitfalls, and a DI wrapper service for testability. USE FOR: "secure storage", "SecureStorage", "store token securely", "Keychain", "Android Keystore", "save secret", "encrypted storage", "store credentials", "sensitive data storage". DO NOT USE FOR: general file storage (use maui-file-handling), SQLite databases (use maui-sqlite-database), or authentication flows (use maui-authentication).
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.